information security

Your Path into Cybersecurity: “Yes, coding is important” (Series 1: Ep 6)

A series based on the original 10 step pathway

It’s been a while since my last post - hey, ya girl has been busy! But I plan to expedite the remaining 4 topics in this series.

I’m often asked, “Do I need to know how to code to work in Cybersecurity?” The short answer to this is yes and no. It all depends on the area of InfoSec (and I use this interchangeably with Cybersecurity) in which you are interested. Either way, it will only help. In many disciplines of the field, it will be a powerful skill. Your skill level can also vary and that is ok. 

Let’s take a moment to think about some areas of the industry where coding will serve you in a meaningful way:

  • Incident Response
  • Malware Analysis
  • Reverse Engineering (duh!)
  • Penetration Testing 
  • Web Application Security 
  • Dev SecOps

As defenders, we have many doors to secure, so automation is key - we need all the help we can get. Automation may come into play when integrating toolsets, triaging events, such as sending suspicious files to a sandbox or checking domain/IP reputation. It may also assist in your response efforts, such as automating the ability to globally block hashes. Your coding skills can be very beneficial in this area. 

If you are a responder, analyzing malware will be a necessity; so understanding it beyond dynamic analysis is a advantageous. As you may know, malware may not run as intended in certain environments. Analyzing the malware statically will afford you the ability to step through the code, identify where certain activities should occur, work around encryption routines, etc. It can be beneficial at very basic levels to simply understand the flow or on a more advanced level, such as reverse engineering. I can hear folk saying “But I can use <insert cool malware analysis tool>”. Yes, of course. However, in my opinion, tools should be used to help enable and for efficiency . To use them without understanding core concepts is like using a calculator without understanding math. A team of Responders is best with a diverse set of skills, so not everyone on the team will need a deep understanding of Assembly language. 

As a PenTester, you will use code to craft exploits or write scripts to make your offensive activities more efficient. When you “pop” a box, you may want to take advantage of the shell resident on the machine or add code to a compromised web server. With creativity, the possibilities are endless. 

In working with the Web Application teams, at the least, you will need to review code to ensure security best practices are being adhered to. You’ll need to understand how flaws in the code lead to vulnerabilities and how to fix it. 

On the opposite end of the spectrum, coding is not as much of a necessity if you are interested or working in an area, such as Compliance/Governance. A role within this discipline will be less technical and focused on high level policies and reporting. So, yes, you can skip the coding course, if you'd like to focus your efforts along this line. 

These are just a few areas in which those coding skills could be put to use. If you are wondering what language you should learn - I would hedge my bet on Python for interpreted languages or C for mid-level. I don’t have a huge amount of experience with it, but Go looks pretty interesting and I’d like to spend some time with it. Check out Learn Python and Python for Security

Have fun Securing Your Path!

Your Path into Cybersecurity: “yes, but/and…” (Series 1: Ep 5)

A series based on the original 10 step pathway.

Cybersecurity tends to be considered an operational expense to a company, as it is not income generating. However, we do save the company money, reputational damage, etc., if done properly. But, at the end of the day, we are not the business! We support the business; and in supporting the business, we have to learn to work with and not against.

Take time to learn the business, how it operates, what is important and the best way to secure it. This approach allows us to "yes, but(or and)...", instead of no. If we understand what the business or business units are trying to achieve, we should be in a better position to build security into it.

In Sales, they are taught to say, "yes, but(or and)..." instead of no. This leaves opportunity to suggest alternatives rather than turning down an idea. We can learn a great deal from that approach. For example, if the business wants to move towards the 'cloud' but Security folk, being ultra apprehensive advises against it - what does this do? Does it get us closer to a more secure organization? Many times, it leaves a business to accept a certain amount of risk and move forward with their plan - most likely without the guidance of the Security team. What if the Security team mentioned that if moving to the cloud has a significant advantage for the business, the teams (including Network and Application teams) should consider a 'zero trust model'. This may spark additional conversation and lead to projects which will increase the security posture of the organization.

My point is saying this is that the Security team should welcome new ideas and approaches to doing business, work to understand the end goal, why it is important and determined the best security measure(s) to be implemented. This approach makes the Security team a partner in the game, instead of the team that gets engaged when something goes observably wrong. We all know it is typically a tad bit late at that point.

We aren't the gatekeepers (or maybe we are). But let's focus on building security in from the onset!

Your Path into Cybersecurity: Understand Networking (S1: Ep2)

A series based on the original 10 step pathway

To “Understand Networking” was the 2nd point in my original 10 step pathway article.

Networking is a fundamental component of Cybersecurity. How can one protect a network that one doesn’t understand? <I’m out in cyberspace waiting on the answer>...still waiting.

So, some people may be thinking - “Ok, computer networks, got it! But what exactly do I need to know?” Well, there is great deal to explore, and the depth of your knowledge will only make you that much more desirable. I can't tell you the best mode for you, as we all have different learning styles. But remember, the development of computers began in the 1950s; and there has been much iteration and innovation since then -- I think this is debatable. I actually think we experienced slow and steady growth, then a surge in innovation. But, I digress.

Understanding basic concepts, such as, the OSI model, protocols (e.g. TCP/IP, DHCP, ARP, ICMP, HTTP, FTP) will give you a foothold on how networks function under the hood. It’ll allow you to discern how packets are being transmitted and if typical methods of transmission are being used. You’ll be able to identify how data moves across stacks, and if traffic you are observing follows expected RFC (IETF Request For Comment) standards.

You should understand network infrastructure - the resources that enable network connectivity. If you have a grasp on the way infrastructures are setup, you should understand how the hardware and software of your network work together to allow communication flow, organization and management of the enterprise - within and between intra, inter and external networks.

With that, you’ll be able to ascertain why communication is occurring between certain IP addresses, why traffic is being off-loaded to another server and a host of other important types of activity on your network.

Think about it - a network designed for high availability, which is true for most enterprise networks, should be highly available, fault tolerant and redundant. If you understand how your network is setup to achieve these goals, you should have much of the information you need to be in a better position to protect it.

There are tons of free resources online to get you up to speed on your networking knowledge. However, my favorite suggestion, is to work on a project to reinforce theoretical concepts.

So, queue project proposal. If you are just starting out, build a small home lab. Check out all the home labs with varied complexity at /r/homelab/.

I promise not to wait a whole month before writing Ep 3. Geez! Time waits for no one.

Your Path into Cybersecurity

I’m often asked how should one get started in Cybersecurity. I could probably write a multi-page article on this, but TLDR. However, here are 10 tips when considering a career in the field.

 

  1. Ask yourself - can I work well under pressure and can I deal with the ebbs and flows of a highly dynamic industry?

  2. Understand Networking. Prior to the term “Cybersecurity” and universities offering a major for the field, SMEs (Subject Matter Experts) came from Networks, Infrastructures, etc. and had a keen interest in Security. You can’t protect a network that you don’t understand.

  3. Familiarize yourself with the many disciplines in the field - It is hard for me to answer questions about getting into the field, when one does not have an idea of the area in which they’d like to focus. Do you want to be offensive or defensive, project focused, or on the front-lines, reactive or proactive? Guess what? There are also areas that are not technically focused. For a list of disciplines within the field, check out the Cybersecurity Workforce Framework.

  4. Build a base level knowledge bank across several disciplines of Information Security - Then hone in on a particular discipline. Know enough about a particular area of the industry, to where when people need help, they come to you.

  5. Learn to say “yes, but…”, instead of no! This is something I learned from a close friend who was in sales. He always said “yes, but”; even when he did not quite know how he would deliver. This ideology forces security folk to think beyond the innate security components and understand the business, and what it would take to put forth a business driven, but security focused product/service.

  6. Yes, coding is important. I’m often asked, “Do I need to know how to code to work in Cybersecurity?” The short answer to this is yes and no. It all depends on the area of InfoSec in which you are interested. Either way, it will only help. In many disciplines of the field, it will be a powerful skill. Your skill level can also very and that is ok. As defenders, we have many doors to secure, so automation is key - we need all the help we can get. Your coding skills can be very beneficial in this area. If you are a responder, analyzing malware will be a necessity, so understanding it beyond dynamic analysis is very helpful. As a PenTester, you will use code to craft exploits or white scripts to make your offensive activities more efficient. These are just a few areas in which those coding skills could be put to use. If you are wondering what language you should learn - I would hedge my bet on Python. Check out Learn Python and Python for Security.

  7. PoC your Skills - Oh you got skillz?! Create a project - whether it be community focused, specifically for work, or for your own internal arsenal. This will allow you to gain a deeper understanding in the area, work through some real world issues, testing and implementation. Not only could it be beneficial to your upskilling; but it could also act as proof to a prospective employer or client that you know what you claim.

  8. Stop being such an introvert, already! I know it is hard, but in this industry, like many others, it is mostly about who you know. Building that community allows one to learn and share, to build courage, trust and keep connections open and warm for when you need them. Check out security related events on Meetup and follow-up some cool people on Twitter - here is a list. Also, check out The Power of Weak Connections.

  9. Mentor and be mentored - I believe in the saying “ be somebody before you say you need somebody. This boils down to proving yourself and bringing something to the table before expecting it from others. People in the industry are more than willing to help those that also prove themselves to be resourceful.

  10. Be a lifetime learner - This industry will require consistent drive and a love for learning. The beauty of it all, is that most of what you need to know or would want to know is available free of charge on the interwebz. The community is full of folk who are interested in contributing, so there is always opportunity to learn from others and in turn, provide your contribution. People tend to ask, “Do I need certifications?” I’m of the mindset that thought providing questions can be more powerful than answers. So, what are you trying to achieve by getting a certification and what is the potential value of attaining it? Are they helpful - yes, they can be. If you earn the right certification, it can prove to the world that you are knowledgeable in that particular area. However, that is not the only way to prove your skillset. Certs also tend to be expensive. But expensive is relative. So, for example, if a $5k training and cert yields you a $10k raise, its is more than worth it. What is the opportunity cost? That is what you should consider. I have 5 certs, so it is safe to say, I think they are valuable. However, mine were all employer paid - so the decision on worth, if self paid is much different. Check out SANS, for a list of training opportunities and the accompanying GIAC certifications.


 

You may have to fight a battle more than once to win it

- Margaret Thatcher